Aug 25 03:53:23 vlre-nyc-1 sshd\[30048\]: Invalid user mysql from 125.75.4.83
Aug 25 03:53:23 vlre-nyc-1 sshd\[30048\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.75.4.83
Aug 25 03:53:25 vlre-nyc-1 sshd\[30048\]: Failed password for invalid user mysql from 125.75.4.83 port 34778 ssh2
Aug 25 03:59:21 vlre-nyc-1 sshd\[30141\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.75.4.83  user=root
Aug 25 03:59:23 vlre-nyc-1 sshd\[30141\]: Failed password for root from 125.75.4.83 port 54878 ssh2
...

Aug 18 00:49:26 firewall sshd[25874]: Invalid user sttest from 125.75.4.83
Aug 18 00:49:28 firewall sshd[25874]: Failed password for invalid user sttest from 125.75.4.83 port 60906 ssh2
Aug 18 00:57:38 firewall sshd[26140]: Invalid user test01 from 125.75.4.83
...

Aug 14 05:40:26 vps647732 sshd[23876]: Failed password for root from 125.75.4.83 port 53200 ssh2
...

Aug 13 06:45:45 vmd36147 sshd[29152]: Failed password for root from 125.75.4.83 port 48352 ssh2
Aug 13 06:49:36 vmd36147 sshd[5183]: Failed password for root from 125.75.4.83 port 54380 ssh2
...

Aug  8 20:10:17 marvibiene sshd[62132]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.75.4.83  user=root
Aug  8 20:10:19 marvibiene sshd[62132]: Failed password for root from 125.75.4.83 port 41452 ssh2
Aug  8 20:25:28 marvibiene sshd[62302]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.75.4.83  user=root
Aug  8 20:25:30 marvibiene sshd[62302]: Failed password for root from 125.75.4.83 port 43312 ssh2

$f2bV_matches

Jun 30 09:22:26 vm0 sshd[6773]: Failed password for root from 125.75.4.83 port 46336 ssh2
...

SSH/22 MH Probe, BF, Hack -

Jun 11 13:39:00 gestao sshd[9718]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.75.4.83 
Jun 11 13:39:02 gestao sshd[9718]: Failed password for invalid user jirka from 125.75.4.83 port 54442 ssh2
Jun 11 13:41:17 gestao sshd[9841]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.75.4.83 
...

2020-06-04T15:53:13.094311mail.standpoint.com.ua sshd[23889]: Failed password for root from 125.75.4.83 port 44252 ssh2
2020-06-04T15:54:46.858352mail.standpoint.com.ua sshd[24092]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.75.4.83  user=root
2020-06-04T15:54:49.242040mail.standpoint.com.ua sshd[24092]: Failed password for root from 125.75.4.83 port 60310 ssh2
2020-06-04T15:56:19.732953mail.standpoint.com.ua sshd[24295]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.75.4.83  user=root
2020-06-04T15:56:21.549418mail.standpoint.com.ua sshd[24295]: Failed password for root from 125.75.4.83 port 48140 ssh2
...

Jun  2 08:45:01 journals sshd\[34905\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.75.4.83  user=root
Jun  2 08:45:03 journals sshd\[34905\]: Failed password for root from 125.75.4.83 port 45462 ssh2
Jun  2 08:49:26 journals sshd\[35433\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.75.4.83  user=root
Jun  2 08:49:28 journals sshd\[35433\]: Failed password for root from 125.75.4.83 port 34470 ssh2
Jun  2 08:53:56 journals sshd\[36046\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.75.4.83  user=root
...

SSH bruteforce

(sshd) Failed SSH login from 125.75.4.83 (CN/China/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_SSHD; Logs: Apr 20 00:24:03 amsweb01 sshd[31366]: Invalid user er from 125.75.4.83 port 36086
Apr 20 00:24:04 amsweb01 sshd[31366]: Failed password for invalid user er from 125.75.4.83 port 36086 ssh2
Apr 20 00:31:41 amsweb01 sshd[32322]: Invalid user postgres from 125.75.4.83 port 55076
Apr 20 00:31:43 amsweb01 sshd[32322]: Failed password for invalid user postgres from 125.75.4.83 port 55076 ssh2
Apr 20 00:36:47 amsweb01 sshd[675]: Invalid user ftpuser from 125.75.4.83 port 55896

$f2bV_matches

SSH login attempts.

Invalid user test9 from 125.75.4.83 port 54054

Mar 18 10:09:40 firewall sshd[23597]: Failed password for root from 125.75.4.83 port 45410 ssh2
Mar 18 10:11:01 firewall sshd[23697]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.75.4.83  user=root
Mar 18 10:11:03 firewall sshd[23697]: Failed password for root from 125.75.4.83 port 59840 ssh2
...

Invalid user testnet from 125.75.4.83 port 57074

2020-03-13T00:28:36.891179abusebot-3.cloudsearch.cf sshd[24096]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.75.4.83  user=root
2020-03-13T00:28:38.939722abusebot-3.cloudsearch.cf sshd[24096]: Failed password for root from 125.75.4.83 port 33894 ssh2
2020-03-13T00:30:57.178419abusebot-3.cloudsearch.cf sshd[24277]: Invalid user deploy from 125.75.4.83 port 34158
2020-03-13T00:30:57.184665abusebot-3.cloudsearch.cf sshd[24277]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.75.4.83
2020-03-13T00:30:57.178419abusebot-3.cloudsearch.cf sshd[24277]: Invalid user deploy from 125.75.4.83 port 34158
2020-03-13T00:30:59.589366abusebot-3.cloudsearch.cf sshd[24277]: Failed password for invalid user deploy from 125.75.4.83 port 34158 ssh2
2020-03-13T00:33:14.294689abusebot-3.cloudsearch.cf sshd[24404]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.75.4.83  user=r
...

Jun  7 00:34:48 NPSTNNYC01T sshd[8786]: Failed password for root from 125.75.47.98 port 48544 ssh2
Jun  7 00:35:51 NPSTNNYC01T sshd[8962]: Failed password for root from 125.75.47.98 port 55758 ssh2
...

Portscan or hack attempt detected by psad/fwsnort

445/tcp 1433/tcp...
[2019-10-25/11-16]6pkt,2pt.(tcp)

Oct 07 20:21:58 host sshd[15935]: Invalid user guest from 125.75.45.28 port 33491

Port Scan: TCP/445

Dec  4 02:46:35 hpm sshd\[4083\]: Invalid user abdenace from 142.44.160.173
Dec  4 02:46:35 hpm sshd\[4083\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.ip-142-44-160.net
Dec  4 02:46:37 hpm sshd\[4083\]: Failed password for invalid user abdenace from 142.44.160.173 port 43834 ssh2
Dec  4 02:52:04 hpm sshd\[4656\]: Invalid user pass from 142.44.160.173
Dec  4 02:52:04 hpm sshd\[4656\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.ip-142-44-160.net

MultiHost/MultiPort Probe, Scan, Hack -

MultiHost/MultiPort Probe, Scan, Hack -

Dec  4 12:12:08 legacy sshd[18125]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.237.140.120
Dec  4 12:12:11 legacy sshd[18125]: Failed password for invalid user kurjat from 45.237.140.120 port 60398 ssh2
Dec  4 12:19:36 legacy sshd[18486]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=45.237.140.120
...

Dec  4 12:19:06 herz-der-gamer sshd[16666]: Invalid user loan from 139.155.50.40 port 55398
Dec  4 12:19:06 herz-der-gamer sshd[16666]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.155.50.40
Dec  4 12:19:06 herz-der-gamer sshd[16666]: Invalid user loan from 139.155.50.40 port 55398
Dec  4 12:19:08 herz-der-gamer sshd[16666]: Failed password for invalid user loan from 139.155.50.40 port 55398 ssh2
...

Unauthorised access (Dec  4) SRC=114.25.173.192 LEN=52 TTL=106 ID=17286 DF TCP DPT=445 WINDOW=8192 SYN

DigitalOcean BotNet attack - 10s of requests to non-existent pages - :443/app-ads.txt - typically bursts of 8 requests per second - undefined, XSS attacks
node-superagent/4.1.0

Dec  4 07:46:57 linuxvps sshd\[57157\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.158.218  user=root
Dec  4 07:46:59 linuxvps sshd\[57157\]: Failed password for root from 54.37.158.218 port 49790 ssh2
Dec  4 07:52:38 linuxvps sshd\[60487\]: Invalid user ayse from 54.37.158.218
Dec  4 07:52:38 linuxvps sshd\[60487\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=54.37.158.218
Dec  4 07:52:40 linuxvps sshd\[60487\]: Failed password for invalid user ayse from 54.37.158.218 port 55194 ssh2

Nov 10 16:16:48 microserver sshd[51489]: Failed password for invalid user 22 from 185.153.199.125 port 58625 ssh2
Nov 10 16:16:50 microserver sshd[51489]: Failed password for invalid user 22 from 185.153.199.125 port 58625 ssh2
Nov 10 16:16:53 microserver sshd[51489]: Failed password for invalid user 22 from 185.153.199.125 port 58625 ssh2
Nov 10 16:16:55 microserver sshd[51489]: Failed password for invalid user 22 from 185.153.199.125 port 58625 ssh2
Nov 10 16:16:58 microserver sshd[51489]: Failed password for invalid user 22 from 185.153.199.125 port 58625 ssh2
Nov 10 16:17:04 microserver sshd[51506]: Invalid user 101 from 185.153.199.125 port 22097
Nov 10 16:17:05 microserver sshd[51506]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=185.153.199.125
Nov 10 16:17:07 microserver sshd[51506]: Failed password for invalid user 101 from 185.153.199.125 port 22097 ssh2
Nov 10 16:17:09 microserver sshd[51517]: Invalid user 123 from 185.153.199.125 port 21947
Nov 10 16:17:0

2019-12-04T12:48:20.983447shield sshd\[22151\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.23.68  user=root
2019-12-04T12:48:22.660344shield sshd\[22151\]: Failed password for root from 139.59.23.68 port 39090 ssh2
2019-12-04T12:55:39.516099shield sshd\[24194\]: Invalid user secci from 139.59.23.68 port 50810
2019-12-04T12:55:39.520479shield sshd\[24194\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=139.59.23.68
2019-12-04T12:55:41.799209shield sshd\[24194\]: Failed password for invalid user secci from 139.59.23.68 port 50810 ssh2

Dec  4 13:12:41 localhost sshd\[11712\]: Invalid user test6 from 103.10.168.8 port 21690
Dec  4 13:12:41 localhost sshd\[11712\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.10.168.8
Dec  4 13:12:43 localhost sshd\[11712\]: Failed password for invalid user test6 from 103.10.168.8 port 21690 ssh2
...

Dec  2 04:40:45 microserver sshd[7117]: Failed none for root from 222.186.42.4 port 58888 ssh2
Dec  2 04:40:45 microserver sshd[7117]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.4  user=root
Dec  2 04:40:48 microserver sshd[7117]: Failed password for root from 222.186.42.4 port 58888 ssh2
Dec  2 04:40:51 microserver sshd[7117]: Failed password for root from 222.186.42.4 port 58888 ssh2
Dec  2 04:40:55 microserver sshd[7117]: Failed password for root from 222.186.42.4 port 58888 ssh2
Dec  2 06:12:29 microserver sshd[21663]: Failed none for root from 222.186.42.4 port 53180 ssh2
Dec  2 06:12:30 microserver sshd[21663]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=222.186.42.4  user=root
Dec  2 06:12:32 microserver sshd[21663]: Failed password for root from 222.186.42.4 port 53180 ssh2
Dec  2 06:12:35 microserver sshd[21663]: Failed password for root from 222.186.42.4 port 53180 ssh2
Dec  2 06:12:38 microserver ssh

Dec  4 13:42:28 localhost sshd\[2340\]: Invalid user admin from 115.231.231.3 port 54096
Dec  4 13:42:28 localhost sshd\[2340\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=115.231.231.3
Dec  4 13:42:30 localhost sshd\[2340\]: Failed password for invalid user admin from 115.231.231.3 port 54096 ssh2

Telnet/23 MH Probe, BF, Hack -

Automatic report - Banned IP Access